From ec57ad4fb9aaa6f5ada4eef869383b137aa1a0cf Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Thu, 17 Dec 2020 17:14:22 -0800
Subject: [PATCH] Implement taskbar layout GPO

---
 Azure/Ansible/roles/dc/tasks/main.yml         |  15 +++++++
 ESXi/ansible/roles/dc/tasks/main.yml          |  15 +++++++
 Vagrant/Vagrantfile                           |   1 +
 .../Backup.xml                                |   8 ++--
 .../Machine/Preferences/Registry/Registry.xml |   3 ++
 .../DomainSysvol/GPO/Machine/comment.cmtx     |   0
 .../DomainSysvol/GPO/Machine/registry.pol     | Bin
 .../bkupInfo.xml                              |   1 +
 .../gpreport.xml                              | Bin 30544 -> 30546 bytes
 .../Machine/Preferences/Registry/Registry.xml |   3 --
 .../bkupInfo.xml                              |   1 -
 .../GPO/taskbar_layout/DetectionLabLayout.xml |  26 ++++++++++++
 .../Backup.xml                                |  18 +++++++++
 .../DomainSysvol/GPO/Machine/comment.cmtx     |  12 ++++++
 .../DomainSysvol/GPO/Machine/registry.pol     | Bin 0 -> 1090 bytes
 .../DomainSysvol/GPO/User/comment.cmtx        |  12 ++++++
 .../DomainSysvol/GPO/User/registry.pol        | Bin 0 -> 8 bytes
 .../bkupInfo.xml                              |   1 +
 .../gpreport.xml                              | Bin 0 -> 26526 bytes
 .../scripts/configure-taskbar-layout-gpo.ps1  |  37 ++++++++++++++++++
 Vagrant/scripts/install-sysinternals.ps1      |  19 ++++++++-
 21 files changed, 163 insertions(+), 9 deletions(-)
 rename Vagrant/resources/GPO/disable_windows_defender/{{F2150233-4B8F-4347-8D70-23D3984D9B78} => {01E4A146-C220-48E2-A0F5-9AAF790529F6}}/Backup.xml (56%)
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
 rename Vagrant/resources/GPO/disable_windows_defender/{{F2150233-4B8F-4347-8D70-23D3984D9B78} => {01E4A146-C220-48E2-A0F5-9AAF790529F6}}/DomainSysvol/GPO/Machine/comment.cmtx (100%)
 rename Vagrant/resources/GPO/disable_windows_defender/{{F2150233-4B8F-4347-8D70-23D3984D9B78} => {01E4A146-C220-48E2-A0F5-9AAF790529F6}}/DomainSysvol/GPO/Machine/registry.pol (100%)
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/bkupInfo.xml
 rename Vagrant/resources/GPO/disable_windows_defender/{{F2150233-4B8F-4347-8D70-23D3984D9B78} => {01E4A146-C220-48E2-A0F5-9AAF790529F6}}/gpreport.xml (93%)
 delete mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
 delete mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/DetectionLabLayout.xml
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/Backup.xml
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/comment.cmtx
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/registry.pol
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/comment.cmtx
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/registry.pol
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/bkupInfo.xml
 create mode 100644 Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/gpreport.xml
 create mode 100644 Vagrant/scripts/configure-taskbar-layout-gpo.ps1

diff --git a/Azure/Ansible/roles/dc/tasks/main.yml b/Azure/Ansible/roles/dc/tasks/main.yml
index c4f8baa..4feb68b 100644
--- a/Azure/Ansible/roles/dc/tasks/main.yml
+++ b/Azure/Ansible/roles/dc/tasks/main.yml
@@ -156,6 +156,21 @@
 - debug: msg="{{ rdp_gpo.stdout_lines }}"
   when: rdp_gpo.stdout_lines is defined
 
+- name: Configure Taskbar Layout GPO
+  win_shell: .\\configure-taskbar-layout-gpo.ps1
+  args:
+    chdir: 'c:\vagrant\scripts'
+  register: taskbar_gpo
+  vars:
+    ansible_become: yes
+    ansible_become_method: runas
+    ansible_become_user: windomain.local\vagrant
+    ansible_become_password: vagrant
+    ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
+  failed_when: "'Exception' in taskbar_gpo.stderr"
+
+- debug: msg="{{ taskbar_gpo.stdout_lines }}"
+
 - name: Configure DC with raw Commands
   win_shell: "{{ item }}"
   with_items:
diff --git a/ESXi/ansible/roles/dc/tasks/main.yml b/ESXi/ansible/roles/dc/tasks/main.yml
index 379d341..1578cc5 100644
--- a/ESXi/ansible/roles/dc/tasks/main.yml
+++ b/ESXi/ansible/roles/dc/tasks/main.yml
@@ -139,6 +139,21 @@
 
 - debug: msg="{{ rdp_gpo.stdout_lines }}"
 
+- name: Configure Taskbar Layout GPO
+  win_shell: .\\configure-taskbar-layout-gpo.ps1
+  args:
+    chdir: 'c:\vagrant\scripts'
+  register: taskbar_gpo
+  vars:
+    ansible_become: yes
+    ansible_become_method: runas
+    ansible_become_user: windomain.local\vagrant
+    ansible_become_password: vagrant
+    ansible_become_flags: logon_type=new_credentials logon_flags=netcredentials_only
+  failed_when: "'Exception' in taskbar_gpo.stderr"
+
+- debug: msg="{{ taskbar_gpo.stdout_lines }}"
+
 - name: Configure DC with raw Commands
   win_shell: "{{ item }}"
   with_items:
diff --git a/Vagrant/Vagrantfile b/Vagrant/Vagrantfile
index 2bfe973..d7d646b 100644
--- a/Vagrant/Vagrantfile
+++ b/Vagrant/Vagrantfile
@@ -75,6 +75,7 @@ Vagrant.configure("2") do |config|
     cfg.vm.provision "shell", path: "scripts/configure-AuditingPolicyGPOs.ps1", privileged: false
     cfg.vm.provision "shell", path: "scripts/configure-rdp-user-gpo.ps1", privileged: false
     cfg.vm.provision "shell", path: "scripts/configure-disable-windows-defender-gpo.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-taskbar-layout-gpo.ps1", privileged: false
     cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false
     cfg.vm.provision "shell", inline: 'wevtutil el | Select-String -notmatch "Microsoft-Windows-LiveId" | Foreach-Object {wevtutil cl "$_"}', privileged: false
     cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/Backup.xml
similarity index 56%
rename from Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
rename to Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/Backup.xml
index b376e3d..c3e5a47 100644
--- a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
+++ b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/Backup.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?><!-- Copyright (c) Microsoft Corporation.  All rights reserved. --><GroupPolicyBackupScheme bkp:version="2.0" bkp:type="GroupPolicyBackupTemplate" xmlns:bkp="http://www.microsoft.com/GroupPolicy/GPOOperations" xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations">
-    <GroupPolicyObject><SecurityGroups><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-1000]]></Sid><SamAccountName><![CDATA[vagrant]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[vagrant@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Domain Admins@windomain.local]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}]]></ID><Domain><![CDATA[windomain.local]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[Disable Windows Defender]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[65537]]></UserVersionNumber><MachineVersionNumber><![CDATA[720907]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{00000000-0000-0000-0000-000000000000}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{B087BE9D-ED37-454F-AF9C-04291E351182}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}]]]></MachineExtensionGuids><UserExtensionGuids/><WMIFilter/></GroupPolicyCoreSettings> 
+    <GroupPolicyObject><SecurityGroups><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-1000]]></Sid><SamAccountName><![CDATA[vagrant]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[vagrant@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Domain Admins@windomain.local]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{2C55A216-EFB4-4959-8F7B-E049518C4DF2}]]></ID><Domain><![CDATA[windomain.local]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[Disable Windows Defender]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[65537]]></UserVersionNumber><MachineVersionNumber><![CDATA[851981]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{00000000-0000-0000-0000-000000000000}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{B087BE9D-ED37-454F-AF9C-04291E351182}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}]]]></MachineExtensionGuids><UserExtensionGuids/><WMIFilter/></GroupPolicyCoreSettings> 
         <GroupPolicyExtension bkp:ID="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" bkp:DescName="Registry">
-            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\registry.pol" bkp:Location="DomainSysvol\GPO\Machine\registry.pol"/>
+            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Machine\registry.pol" bkp:Location="DomainSysvol\GPO\Machine\registry.pol"/>
             
-            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Adm\*.*"/>
+            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Adm\*.*"/>
         </GroupPolicyExtension>
         
         
@@ -14,5 +14,5 @@
         
         
         
-    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\comment.cmtx" bkp:Location="DomainSysvol\GPO\Machine\comment.cmtx"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences" bkp:Location="DomainSysvol\GPO\Machine\Preferences"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences\Registry" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry"/><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry\Registry.xml" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences\Registry\Registry.xml" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry\Registry.xml"/></GroupPolicyExtension></GroupPolicyObject>
+    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Machine\comment.cmtx" bkp:Location="DomainSysvol\GPO\Machine\comment.cmtx"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Machine\Preferences" bkp:Location="DomainSysvol\GPO\Machine\Preferences"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Machine\Preferences\Registry" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry"/><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry\Registry.xml" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\Machine\Preferences\Registry\Registry.xml" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry\Registry.xml"/><FSObjectDir bkp:Path="%GPO_USER_FSPATH%\Applications" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\User\Applications" bkp:Location="DomainSysvol\GPO\User\Applications"/><FSObjectDir bkp:Path="%GPO_USER_FSPATH%\Documents &amp; Settings" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\User\Documents &amp; Settings" bkp:Location="DomainSysvol\GPO\User\Documents &amp; Settings"/><FSObjectDir bkp:Path="%GPO_USER_FSPATH%\Scripts" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\User\Scripts" bkp:Location="DomainSysvol\GPO\User\Scripts"/><FSObjectDir bkp:Path="%GPO_USER_FSPATH%\Scripts\Logoff" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\User\Scripts\Logoff" bkp:Location="DomainSysvol\GPO\User\Scripts\Logoff"/><FSObjectDir bkp:Path="%GPO_USER_FSPATH%\Scripts\Logon" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{2C55A216-EFB4-4959-8F7B-E049518C4DF2}\User\Scripts\Logon" bkp:Location="DomainSysvol\GPO\User\Scripts\Logon"/></GroupPolicyExtension></GroupPolicyObject>
 </GroupPolicyBackupScheme>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
new file mode 100644
index 0000000..a7d1832
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}"><Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="AmsiEnable" status="AmsiEnable" image="10" changed="2020-12-18 01:01:54" uid="{D1534272-C9FB-491D-A48B-39551C57F89B}"><Properties action="C" displayDecimal="1" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows Script Host\Settings" name="AmsiEnable" type="REG_DWORD" value="00000000"/></Registry>
+</RegistrySettings>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/comment.cmtx
similarity index 100%
rename from Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx
rename to Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/comment.cmtx
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/registry.pol
similarity index 100%
rename from Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol
rename to Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/DomainSysvol/GPO/Machine/registry.pol
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/bkupInfo.xml
new file mode 100644
index 0000000..bf2eefa
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/bkupInfo.xml
@@ -0,0 +1 @@
+<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{2C55A216-EFB4-4959-8F7B-E049518C4DF2}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{fcb5ab32-1521-4219-8304-2eaea4a73439}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2020-12-18T01:03:20]]></BackupTime><ID><![CDATA[{01E4A146-C220-48E2-A0F5-9AAF790529F6}]]></ID><Comment><![CDATA[Disable Windows Defender]]></Comment><GPODisplayName><![CDATA[Disable Windows Defender]]></GPODisplayName></BackupInst>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml b/Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/gpreport.xml
similarity index 93%
rename from Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml
rename to Vagrant/resources/GPO/disable_windows_defender/{01E4A146-C220-48E2-A0F5-9AAF790529F6}/gpreport.xml
index 86dd38461ace4f136177648df1fafc5ea4d05275..c8cebf5abcc428b859444286a3220c0952db1113 100644
GIT binary patch
delta 1039
zcmbtTJx>%-6g{&$yKZzMaS4f-Xf~R-g&CbUANv7p+}Q;J0TIzgEeu}?7_s3aB!<Mo
ze{g$S3b#NWjRm&E4oxKd0<9q0o5*=11txTpmv`sRJ@=k_^K#GrvGwiP+8W4=`e-BK
ziQz+`0vAIVMhhXm5OpGTdNszXj2hHCjVngm^aqLg*pR2$TQV8jx|4Zt$(C*RD3&})
zX!~db^s%%mv-Tq*H6k7xnwYT>Liu8k-T5CeHD;{4%&M@JVf1;PVF35!x7{sMxx;>+
zBUX4-GMG>6GRI4pJ$CZRZm!EL^Izo&=|%8lKL0&c{py7eY3lX!!WBCe!KQO5lZxQz
z@?KVMlnU(>&&a2Z`22PG=v)`Ccv1G9clt02bMp4;54}^|&YKRY#+)wg<@G}E=X@F#
z*>uXM^L2Fd+FC}htCv}QyL^z-PXB>r1+u&Rn6_(WRyu11=?qTjUyVOjcZ?-0W0C9s
z8q=7;E6mH^`#tBz%gx4;+2c~OfoC=xHyK+c%N!c?-%vV=4;OG7{baLU3aXyS@1OV-
zGh9kDB%2XmK-7p;C8Dh|v&KkEzBYeaN<PIw?>HV3i!qKDc))KPBN)X5h9ukCIB!}l
Ht=;eh<lw98

delta 1016
zcmbtT&nrYx6h3dfc_fKuCRv$S%z_#3&HFKLn2GnsC@C>mU?IO23L9o2@i(ZGtv>(@
zxho4rDJcmde}J+w<uBm7Z%1~o)4TV(=ljlgZ@qJ#YRW@RIW0s+T*@I#a>*hCdzu_7
zlaF&684t(-lDh|8nufs)VfC>3l&37z24a_I>biK`Q^iT-P-!<H&B9=cbQttO;9@n&
z;U#q<p@W;kX9SFi)h3&7)zR+Xj0Hy4XW(Q)Z3d6c(kvCIm%r2)SE6tIE;I%hJy1zq
z8n>BvoDtk%0a?fyxFrXi2kQhUhgY<hQ1#XN<1qDNuAx;8W5C;)l(=ttSHhTx&*qyt
zaov8ViM`aN7Ru^8d7}x}eva~fM=g}ocIHAGl|3RmDa1cUy$zQ<UnP&lQOt^prv6uj
zTejkSSBP_Cu?KjW^@J)8i(`>knKo#F7HN%E(B<p2Nvr%lkoY&B8Z55MmQDU`X6i()
zN~^R?Mc^GYo}8LIm4HmBWsB;V9XVYV!be`_WL8e09q1)L1ja*@z?JxM@I%r0+%wxs
bG))ymnZ__o^EgccS2*hL{`XdK;9poj-!-G@

diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
deleted file mode 100644
index 2f2034c..0000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
+++ /dev/null
@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}"><Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="EnableAmsi" status="EnableAmsi" image="10" changed="2020-12-02 21:13:55" uid="{7DF9C732-80E6-44B7-8803-5DFE6D7AAC8C}"><Properties action="C" displayDecimal="0" default="0" hive="HKEY_CURRENT_USER" key="SOFTWARE\Microsoft\Windows Script Host\Settings" name="EnableAmsi" type="REG_DWORD" value="00000000"/></Registry>
-</RegistrySettings>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
deleted file mode 100644
index 6d0643d..0000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
+++ /dev/null
@@ -1 +0,0 @@
-<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{535d6ef4-51ff-40f0-bc21-076a19ea0caa}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2020-12-02T21:14:06]]></BackupTime><ID><![CDATA[{F2150233-4B8F-4347-8D70-23D3984D9B78}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[Disable Windows Defender]]></GPODisplayName></BackupInst>
diff --git a/Vagrant/resources/GPO/taskbar_layout/DetectionLabLayout.xml b/Vagrant/resources/GPO/taskbar_layout/DetectionLabLayout.xml
new file mode 100644
index 0000000..4a5f65e
--- /dev/null
+++ b/Vagrant/resources/GPO/taskbar_layout/DetectionLabLayout.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LayoutModificationTemplate
+    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
+    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
+    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
+    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
+    Version="1">
+  <CustomTaskbarLayoutCollection PinListPlacement="Replace">
+    <defaultlayout:TaskbarLayout>
+      <taskbar:TaskbarPinList>
+        <taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"/>
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"/>
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"/>
+        <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk" />
+	    <taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Autoruns.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Process Monitor.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Process Explorer.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Tcpview.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk" />
+		<taskbar:DesktopApp DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk" />
+      </taskbar:TaskbarPinList>
+    </defaultlayout:TaskbarLayout>
+  </CustomTaskbarLayoutCollection>
+</LayoutModificationTemplate>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/Backup.xml b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/Backup.xml
new file mode 100644
index 0000000..3a2e1c5
--- /dev/null
+++ b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/Backup.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Copyright (c) Microsoft Corporation.  All rights reserved. --><GroupPolicyBackupScheme bkp:version="2.0" bkp:type="GroupPolicyBackupTemplate" xmlns:bkp="http://www.microsoft.com/GroupPolicy/GPOOperations" xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations">
+    <GroupPolicyObject><SecurityGroups><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-1000]]></Sid><SamAccountName><![CDATA[vagrant]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[vagrant@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2296914924-2001082525-608774050-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Domain Admins@windomain.local]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{093D7A8E-043E-41D0-B0E1-7D633801A96E}]]></ID><Domain><![CDATA[windomain.local]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ec 23 e8 88 9d 18 46 77 a2 27 49 24 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[Taskbar Layout]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[262148]]></UserVersionNumber><MachineVersionNumber><![CDATA[131074]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]]]></MachineExtensionGuids><UserExtensionGuids><![CDATA[ ]]></UserExtensionGuids><WMIFilter/></GroupPolicyCoreSettings> 
+        <GroupPolicyExtension bkp:ID="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" bkp:DescName="Registry">
+            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Machine\registry.pol" bkp:Location="DomainSysvol\GPO\Machine\registry.pol"/>
+            <FSObjectFile bkp:Path="%GPO_USER_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\User\registry.pol" bkp:Location="DomainSysvol\GPO\User\registry.pol"/>
+            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Adm\*.*"/>
+        </GroupPolicyExtension>
+        
+        
+        
+        
+        
+        
+        
+        
+        
+    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Machine\comment.cmtx" bkp:Location="DomainSysvol\GPO\Machine\comment.cmtx"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Machine\Scripts" bkp:Location="DomainSysvol\GPO\Machine\Scripts"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts\Shutdown" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Machine\Scripts\Shutdown" bkp:Location="DomainSysvol\GPO\Machine\Scripts\Shutdown"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts\Startup" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\Machine\Scripts\Startup" bkp:Location="DomainSysvol\GPO\Machine\Scripts\Startup"/><FSObjectFile bkp:Path="%GPO_USER_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{093D7A8E-043E-41D0-B0E1-7D633801A96E}\User\comment.cmtx" bkp:Location="DomainSysvol\GPO\User\comment.cmtx"/></GroupPolicyExtension></GroupPolicyObject>
+</GroupPolicyBackupScheme>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/comment.cmtx b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/comment.cmtx
new file mode 100644
index 0000000..2109e4f
--- /dev/null
+++ b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/comment.cmtx
@@ -0,0 +1,12 @@
+<?xml version='1.0' encoding='utf-8'?>
+<policyComments xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/CommentDefinitions">
+  <policyNamespaces>
+    <using prefix="ns0" namespace="Microsoft.Policies.StartMenu"></using>
+  </policyNamespaces>
+  <comments>
+    <admTemplate></admTemplate>
+  </comments>
+  <resources minRequiredRevision="1.0">
+    <stringTable></stringTable>
+  </resources>
+</policyComments>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/Machine/registry.pol
new file mode 100644
index 0000000000000000000000000000000000000000..bff686dff6292ccc2bf1773933778f21fde254d6
GIT binary patch
literal 1090
zcmd6l%Syvw5QUH8<4AB{TnH)(_CgDa7#A^#ZD^X-KdI5Z58xyF&3M5=AsdA*X2?wD
zpE>8ujK=wNPtu(xTIx}aS|tj~6>CJMRG}2hRg>v^6v)?K)v<2KRmzB4uQ}6;R=it!
zmq72Hu8302>5?(0@d*vtM6di=ld-CUU*0g?|1+xXNY3F?g47W0yMK2d!@vFEx&XWJ
zj+|*qRPukKTkKjxxOG?8XcFkMg1@PI%G3r+@ddh6uF%7VP7&%ZnDw{n4199yJDan2
z+we0OGV%dr7rrrzDlDTS0pkqRrc$>uR%ILQ>COF^E>G;e@Ehs-1*~1e6aSw1BvZkZ
r{Z`{xM>^Ez+e;9cW>Z(P;hwft8KVM53H?4Rc1^zwWKqX`?WT$!Dd@`^

literal 0
HcmV?d00001

diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/comment.cmtx b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/comment.cmtx
new file mode 100644
index 0000000..2109e4f
--- /dev/null
+++ b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/comment.cmtx
@@ -0,0 +1,12 @@
+<?xml version='1.0' encoding='utf-8'?>
+<policyComments xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/CommentDefinitions">
+  <policyNamespaces>
+    <using prefix="ns0" namespace="Microsoft.Policies.StartMenu"></using>
+  </policyNamespaces>
+  <comments>
+    <admTemplate></admTemplate>
+  </comments>
+  <resources minRequiredRevision="1.0">
+    <stringTable></stringTable>
+  </resources>
+</policyComments>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/registry.pol b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/DomainSysvol/GPO/User/registry.pol
new file mode 100644
index 0000000000000000000000000000000000000000..75e2a096d5a3dfd78c29feb55bf1f752403f7501
GIT binary patch
literal 8
PcmWFtN=;{EU|;|M2`d3`

literal 0
HcmV?d00001

diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/bkupInfo.xml b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/bkupInfo.xml
new file mode 100644
index 0000000..975e6e4
--- /dev/null
+++ b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/bkupInfo.xml
@@ -0,0 +1 @@
+<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{093D7A8E-043E-41D0-B0E1-7D633801A96E}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{fcb5ab32-1521-4219-8304-2eaea4a73439}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2020-12-18T00:53:10]]></BackupTime><ID><![CDATA[{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}]]></ID><Comment><![CDATA[Taskbar Layout]]></Comment><GPODisplayName><![CDATA[Taskbar Layout]]></GPODisplayName></BackupInst>
diff --git a/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/gpreport.xml b/Vagrant/resources/GPO/taskbar_layout/{A21B957F-20E2-491B-A8E7-3BF3AC38E3BE}/gpreport.xml
new file mode 100644
index 0000000000000000000000000000000000000000..bde576be9c25268cb527ff8e294ee0f86b7aa3cd
GIT binary patch
literal 26526
zcmeI5ZBrb_5y$7XtMVPL{6=;vJW1FRnBc;I9jXMVI3(hf-XNYMp3H$IC6%w9<o}zd
zHM4tjw+lu{mandkyW5@V=kDq5on8L--?{L8cpFZ_ap;6!!(O-uy>JxH!fE(x_%cj|
z@i3{+j?SEh9Ub4*+0$?k&t8Sguph=W>RXNZKFo(dg)hQf_$fRK>zZS5PX%#S-+P)1
z%tOt(4CgvFq1T)E8rR=P!gVJ62RiytSSJN{BK$q9hNqz`+=rs!By2}&>X47_1oBwq
zttaZXBe#1sT!X1U(aasuekLx@B$G?=g0xP=!B6q{l{kK;Bgb*%J00(eA0%P&><O32
zuOrFLg%wE)nR9+$Z#0w64<3_C{ch>q4DZClo;ZZke@j0z(%DjY92UZpuq->64AVNo
zw`u8aNx#R!5Bj^TUt=1#Bs+Pe*ApF^(yST%UJm~ew-c@SU5XOjjuN{sKHo%ayBX$j
z>F`Y2-PR|R=Ts#PHS;tV)&%235}gm5`qm4t!z+DWNdHgu`A%5yFd(Ioc$jM+k37~G
zEM+lL2sCV_CzzLlbfw=$$?&lW>Y`@t3Hzn~?uxFXYYOp5-gx`N`1i5SKGbVAd?TIC
z>f3b0H3&k&u_{`LBWBlauo!&%I}@=ChLP}WL{5goe<Ci3HO|G9zK_c?XT;B>IK!g<
z5i#~dOPKKG9ZCB_TwO|YOZwf@5q_WR2yrdhhUu@XQA^VFeOR(Zo18*?cwJm~qb|q9
z>6kdiPthr!Iip|GQ4Z7bs72&SdGAAw<~^oS{C=$0bd;9a2O}pH_h!Z4bG>I3`4;5i
zUkT$v_)fOE68~=KFIKiKN$u<NiT;l1y)Qp_q;FGt?M9kj2|nM6F_RiUsTt7745HAC
zAbls;&%@Wk0uHb&3iqNUyeKZW!iK2W(tAl7e=16l|Ax+O>2piJne*KTl!sI1+~0<}
zCGmC_aPD5~-$*|*HQJCoQb*cI+9bRzc~^NTkIS|BTV&P^KUeUrL|xy`Iu<qeYuU)G
z^so}``MJ1)x)pKNjh2UvVN-CsFWa1yjX#n_@5pDyBqQwG{3Ka7euTxF=S*q@YvdzY
z_+!nR5+ooZwRPFJV_dIct>Swnytl{qN;KeMkL7LK(bp&Ce|tLOehClT;_1otS^N^u
zgl;l{8I68;OUj7@x0TdgQ_lM7vAQ0^*Oj-Pici+;l#_m_ysI3=eHCI=@s$N@ybp?4
zMeaV9um<xo$-_%k?#89(MEAw#mb`6Ew5+Ql!TZ<3OI1wUs#h-bm#nLtsTs8sn&-As
z<%W8R%7F^uK6v?~SP?7Iqu+rI<@G~H(Y+VrNw2}0lFihu=~<jlMcUKLYWbelB=UM-
zW2qm{&ho0H4W;e4`*{5HN8c4mm|lg|0=@8K^zIXBfZERFKd;r5`VoD2ebzjuAJ?WJ
zUI_}-+MY0gwXXT91Z|C=!%&@D9`$*wCzhKITTPNwK800fIr=ENJl7jP-jl~JDE~sY
z^wS2fG>MamRvN|*tgnL)5ie$CO?HGlresq-Bkx!_UjLjMI&)s!9P4$aH4$EhVJTZC
zvz(4WBdVTAr8(U1Y((A5;Al?tp6g}ZyKQCjNAWw7Dr2`<o8qu5?H$YCs~wr@nG((f
z!Mh2>4yt7$__}ELry%d>JKdgYJOO%}SvSW^p9%cdg~LYcy{199%QKrOI1&cqvcykM
zayXTA(LzZA?Pr(hz{YN>_c`g?`p0PMBHCODwrSTo<!LR)0vDvy9r4WSO(eLI*U#%4
z9ka{u7g-~9*s<P3eSV)vC)Q7Ur(Z;iywd|0?eUao1wuQn@RLOSsw6;HbN)J)FQ2Pp
zG|#@xx>jG)N>K%Ctz&dg%W;-R*~o6JyYD0CsMlB4`!xK+D7^1gY)!G473#S@|0bW@
zkc2kXcX=th<=k@Y197yg@105&)lvUsJ&xMY=Tp5H-5srQQ39hiZnVbzQPw!W!ZKR1
zs<nGL($`nJ@~Dr!V%^O(B`UawF&=(;YhS4^SncVIDmSdqUzXolg;};)c0c4jlu_l@
zU+<N2So8Ip)n9o(?q)NaC}>}MjViZ&Rj{MV?Q`yAPU$+S)zRhaSt&YxI<*^D&bzUC
zTOCznqiSr_aa6}`)Nvej96eU|Uq$=;I*xZ!zqQ%X;ZjZeV(+WNTB_jM?(9fZkFK|k
zsy6og4!cU%R5RJG;T%Hws#&RGYCE@yhEd%%y5iP$9jo^s+s-3u*5{UcK{oQ^U2$U%
z`tPl7ThKM*%eV)LEA`x&<o9#5+g~<X(~<;6YubISX`@bLvbuJ=Ei5*+-`nAPS?D#U
zJtrOQzDoBc{xPn-!DXAZiv29yU&qdyBVCg?(5z2mA8j=Q98P6gS#2e&?ho>PRpoot
z=Cps6y>9F^y3oE2R+4Q=h5Cr&?1f`5QgwG*+c}<#&S?(_cgvo~l?zOXX0!4a5x?(e
zUJ`EK7skDH?EkXsgU#a{X9;dskb2?`e<(w&j;O+7x0cI;y@q*2tDmdSd>bXq-cH-G
z?UJs_!DwFAPEGWYM(36CZ1_bv%iZ3C!XC!_UgZhx(AkqWaGe@1-(BA+-M@bnT4wu3
z*WnG?NjevK;r_uCq536)R7^64%{%Dx+KXg+@Q@W(5y^knWNXAcEcsCM;}i9Hxpo|S
zj=|zHI$&pBuJr^hAJYU6jk3Gcc2#me@L`l~M@JLqc7-VEp`*->-I&}*dmzuT$dq44
zV&5=#SNeX!j(9%Hq;URT3gdBC9CWS-UPl_`jugA^-))-NCA#PcZixnVr?R8Br{B=U
zzD)4@PG63fsIgoXy3Zxi9YOLtgOk1zrNH10d!j@~->w9o@nEqS&4}IiQ5#C2A(xBY
zrQ3-T`$Z5enxwm@O&Up;b^SEyvn!bF7bZ4ADbZj--#Vg$yQ}e<ewn=x9h}+DY_bHY
z3HzcTfb}5aCpNC>*QGQAJ+Ec&)!%pncOd;L{Om2g$nf{WYQnxL2*jtsewuqy^3`sp
zeeC8?T(EyO`7S=3xWG5uhsUGco@$oc5;{kpSO`x~I2I)AlpWhx88+h9gPo2k23+YF
zHZ<7!n1KxO3oQ9i-|AGE7ven^(eI#*E9<%a8GbCb>=Dq`yOscBc?toX8P)KOT~XO#
z{rrLs;}|ZX;UFI0)p^@Xj8Ed(E+O^_Ur6WXNBQjB56y#(_Wsch^FjD?cp%tc2`3f|
zOl<kJ?pYnz@gLty?QNuzSZ8~eztkSlmzw=jHn}W0aj)=CaX;vnnt2<^nN*YXh&qSD
zZ*;K+5D`q0xeUxYxC^H$dzXyGVw1Z;sLIn<7Pm_FW%Cq=jxr=*lHZ_3iwA9_!d}^p
z@FM;-X%L-rD<=!%2@t@q+Id}vP;69SE9@A@MqGbx6Ii!LYmcR8@)v9k2)*b-NX=}}
z;tVo<6**-+I*EMuwCdZFD)9CPF#|}Ec2zWA>J9bfZiPRCW=eBs1tFh-?n)gFn`81O
zPH<0DE-jvxK`gL4;JA+h%5xj&M60c@3yiXLles<NHrct<s&H*hM%s37hR;o-kv$MN
zU&W8bd%jVZ8Jf4KZg-ZwQ;z4-vF!Ool%0wL>-XG+G=OMp70=$mYtN#dksY$CQ-o!~
z7qJ^kdiw4Bb1&0gj5j8K?vG%t<2;dzs0?RRS;OSOT6H8i#NQ7i1J_j5GLkIJpRom=
z@WFawK0Sz2;E`cqM=5p_mGN3uUZiv;A99TDd;GR69}gr}bN7eIZ9H40*P;Z;MhCCX
zp5<-|%JB8sv+k$DiS~aGZEuIbF0bcpa_`w2@sQ)`Myo;YzbymLVS1K_2N9`XNU9cH
ztF@d}3&Tba(n5}nU7_AtK(i$r{bSld&gmXDKBs0`oZ{ma9S7SHbNuCYlB|!ly!nYq
zZL2NE!>8j)b@7I1z0Ha;sWq%Rw-j0XN7dtwJ)gjMNmMn<+x_sS5_bvQbY3pKs-|{j
z=RA3hXhY>jzQXtV6Rt-3qK9!4xu?ppjW4FrZ6mJRLUSxHYaf4dJ4`k)$ad4%W_-Vu
zvY%y#^c~3G`9|GV&&SB{&J>@ihx&b&?9ej1YR)(;&rEe4bIIB3**t4C7+HH$JwYA#
zR&VMsvKZ@yvdXinALuWcjc3j2d0>{UTV+PwVKt?7F)S}gxGbNf%SLW)`C@*5r`087
zwyavrCVToKc2q5Qu$n$mjgKD)QW+nSfNBy6_e;JcZ==2%AK{4{kqjoU6-={Kto8f{
zj;YefaT52)lxHfk4zt=@Pl@c>`gvsIR);gQDi^QSy@DaWAwkPD?JUR0<Mytl=9Ox>
zgM=i}Gu<XE!gw?dAx-PTxqRzAF~;RRZnG(*jWp6)h6ShG031elKZkE5GgfS7q%NQ1
z&uc)eqh!@sAAKJ>w`SQ?sQz?Lq?`I!<DwooSYrQkE_r(4M11xW&+eJlerKNOnPSJ?
z#hC=Nxi9STsCi^LQd*u#)!+YA#<uIC({NWgtHbjQ)Vs!c2hAdZc@iF#^FhbRpDvjq
zAC(>z81aLZfcK{C3)?V1&O6V<E_TDFPH}E+L{NPArkGRgCW5AF(L4osR7$C4@=B8{
z5f;<1Vn)|}lDKUZ@wm>y*Kpdr|6S**UIq39*Lo?eQ&3?%bgrLVo1$zU)!s-0P<bFK
zh-Iu3L^ohqC&i^_ItIg~dX!0vPb)gay6JaZXat;D4{S%$vi={>qcwdJZA{ZfPf5GP
z1m{2TOMJsR@C1vR*1xfcT$eY}rM4$x5?_e04<gTr2fE?8C0dWgIcFwO2|GY8^d8RC
zQA{?nuQTw9M%N`ra3soYje!CpsC65;!ygSfj=PesuLQug456n_>p$lb$Zapzj&*oV
zYjv9#Y)?qW`~=UXtKweZ{8i=aI_=lhZszkzk`Be5!JJ#NSxuc%wB)%L9Y(5Jjt$qV
zXCc-b0VnpC`t(kPUFk7vEA{GA-_>bg-83CkJGFIw(8|xEm%NkSnOR7Fogh8&w@PKo
zKFpsNRVTb0;H5pCIgwxGo;$AW(Vo3+ITRjK&peSv9S?POSJL&4Jio9!EaGJm13cQ5
zJ(p)5*;p;mRMLfM*t5WG>C&>El;ft{!y)<#V!nD1y&c~(eOkn=S|nGbP8Ao3Db`g>
z5gm%4`nllPy5!n%s>t>%{*sscOQYPgi5k^4&z{EX9bsrEhw~YwDCoUlJj=Px{iJ%G
zluiyl?-c+tDMK|)SF`MXj|96t?Zu^=$IU7?H<M}dQP&qM5nTX_Kc<JA6V{B9tf4T^
z@ap-<;Cj+Br>^vuvP<;c<|=7!_Z{u};926|MjNZ=+uU`Ka>Ww1CJOtne&$+OmHqI1
zo+QytSwMP@cf#EdrwQ}2q=9^!EAE@+tz3&U%TLrbXXZH$lK|Pu-F05`E=h9_k!Z)A
zi7(>wVwyURFQt)Gc@u?~L_73z{l#)ZV)CnE+)Pr+X&kIQ@2a%ZUxGfoK4Bc*1=Uv5
z6F2+2wCUcN`My0jz$k0F486an$+$&D?7W6eG|at^)ajVn%?nYT{;x!7@0L9|zIj|O
z_c`f5hg;p5Rf1R@QH8Z!iSpH6eEpoyL>|66C7$PGN919zWp|sBRyt$S=*ntWGfgZ-
ziCPWEvyjlNcY9c&kQ|um^PGwt>ND9f>&1LSSGW3K3!1SexK*rm$+X|`wkAH;V}{7J
zP}_G>m3n!E<3}Qc<a|>N<SWXDko6$=pSM)Eq+xa&k)fsP`$NdL8Po4a(%7}_=$;S%
E2j8tFOaK4?

literal 0
HcmV?d00001

diff --git a/Vagrant/scripts/configure-taskbar-layout-gpo.ps1 b/Vagrant/scripts/configure-taskbar-layout-gpo.ps1
new file mode 100644
index 0000000..88436b0
--- /dev/null
+++ b/Vagrant/scripts/configure-taskbar-layout-gpo.ps1
@@ -0,0 +1,37 @@
+# Purpose: Install the GPO that disables Windows Defender and AMSI
+Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Importing the GPO to set the Taskbar layout..."
+Import-GPO -BackupGpoName 'Taskbar Layout' -Path "c:\vagrant\resources\GPO\taskbar_layout" -TargetName 'Taskbar Layout' -CreateIfNeeded
+
+Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Copying layout file to SYSVOL..."
+Copy-Item "c:\vagrant\resources\GPO\taskbar_layout\DetectionLabLayout.xml" "c:\Windows\SYSVOL\domain\scripts\DetectionLabLayout.xml"
+
+$OU = "ou=Domain Controllers,dc=windomain,dc=local"
+$gPLinks = $null
+$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name, distinguishedName, gPLink, gPOptions
+$GPO = Get-GPO -Name 'Taskbar Layout'
+If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path) {
+    New-GPLink -Name 'Taskbar Layout' -Target $OU -Enforced yes
+} Else {
+    Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Taskbar Layout GPO was already linked at $OU. Moving On."
+}
+
+$OU = "ou=Workstations,dc=windomain,dc=local"
+$gPLinks = $null
+$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name, distinguishedName, gPLink, gPOptions
+$GPO = Get-GPO -Name 'Taskbar Layout'
+If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path) {
+    New-GPLink -Name 'Taskbar Layout' -Target $OU -Enforced yes
+} Else {
+    Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Taskbar Layout GPO was already linked at $OU. Moving On."
+}
+
+$OU = "ou=Servers,dc=windomain,dc=local"
+$gPLinks = $null
+$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name, distinguishedName, gPLink, gPOptions
+$GPO = Get-GPO -Name 'Taskbar Layout'
+If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path) {
+    New-GPLink -Name 'Taskbar Layout' -Target $OU -Enforced yes
+} Else {
+    Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Taskbar Layout GPO was already linked at $OU. Moving On."
+}
+gpupdate /force
diff --git a/Vagrant/scripts/install-sysinternals.ps1 b/Vagrant/scripts/install-sysinternals.ps1
index a3f0e87..3caa035 100755
--- a/Vagrant/scripts/install-sysinternals.ps1
+++ b/Vagrant/scripts/install-sysinternals.ps1
@@ -25,7 +25,9 @@ $procexpPath = "C:\Tools\Sysinternals\procexp64.exe"
 $sysmonPath = "C:\Tools\Sysinternals\Sysmon64.exe"
 $tcpviewPath = "C:\Tools\Sysinternals\Tcpview.exe"
 $sysmonConfigPath = "$sysmonDir\sysmonConfig.xml"
+$shortcutLocation = "$ENV:ALLUSERSPROFILE\Microsoft\Windows\Start Menu\Programs\"
 
+$WScriptShell = New-Object -ComObject WScript.Shell
 
 # Microsoft likes TLSv1.2 as well
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
@@ -36,6 +38,9 @@ Try {
   Write-Host "HTTPS connection failed. Switching to HTTP :("
   (New-Object System.Net.WebClient).DownloadFile('http://live.sysinternals.com/Autoruns64.exe', $autorunsPath) 
 }
+$Shortcut = $WScriptShell.CreateShortcut($ShortcutLocation + "Autoruns.lnk")
+$Shortcut.TargetPath = $autorunsPath
+$Shortcut.Save()
 
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Procmon.exe..."
 Try { 
@@ -44,6 +49,9 @@ Try {
   Write-Host "HTTPS connection failed. Switching to HTTP :("
   (New-Object System.Net.WebClient).DownloadFile('http://live.sysinternals.com/Procmon.exe', $procmonPath)
 }
+$Shortcut = $WScriptShell.CreateShortcut($ShortcutLocation + "Process Monitor.lnk")
+$Shortcut.TargetPath = $procmonPath
+$Shortcut.Save()
 
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading PsExec64.exe..."
 Try { 
@@ -60,6 +68,9 @@ Try {
   Write-Host "HTTPS connection failed. Switching to HTTP :("
   (New-Object System.Net.WebClient).DownloadFile('http://live.sysinternals.com/procexp64.exe', $procexpPath)
 }
+$Shortcut = $WScriptShell.CreateShortcut($ShortcutLocation + "Process Explorer.lnk")
+$Shortcut.TargetPath = $procexpPath
+$Shortcut.Save()
 
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Sysmon64.exe..."
 Try { 
@@ -68,6 +79,7 @@ Try {
   Write-Host "HTTPS connection failed. Switching to HTTP :("
   (New-Object System.Net.WebClient).DownloadFile('http://live.sysinternals.com/Sysmon64.exe', $sysmonPath)
 }
+Copy-Item $sysmonPath $sysmonDir
 
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Tcpview.exe..."
 Try { 
@@ -76,7 +88,12 @@ Try {
   Write-Host "HTTPS connection failed. Switching to HTTP :("
   (New-Object System.Net.WebClient).DownloadFile('http://live.sysinternals.com/Tcpview.exe', $tcpviewPath)
 }
-Copy-Item $sysmonPath $sysmonDir
+$Shortcut = $WScriptShell.CreateShortcut($ShortcutLocation + "Tcpview.lnk")
+$Shortcut.TargetPath = $tcpviewPath
+$Shortcut.Save()
+
+# Restart Explorer so the taskbar shortcuts show up
+Stop-Process -ProcessName explorer -Force
 
 # Download Olaf Hartongs Sysmon config
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Olaf Hartong's Sysmon config..."